Eighty-one million login attempts in two weeks — none of them touched MFA. That is the headline number from Huntress’s latest tracking of password-spray campaigns targeting legacy authentication protocols. Today’s Identity Brief connects three threads: the legacy auth blind spot attackers are exploiting at scale, an unverified but plausible claim of mass Entra tenant credential theft, and a CVSS 9.8 macOS authentication bypass that CISA just added to KEV. Underneath all of it is the same failure: identity controls that look complete on paper but leave entire protocol surfaces unprotected.

In the News

Password Spraying Surges 155x Through Legacy Auth Protocols That Bypass MFA

Huntress reported a 155x increase in password-spraying activity, tracking 81 million login attempts across a two-week observation window. The attacks target SMTP, POP3, and IMAP — legacy authentication protocols that predate modern conditional access enforcement and do not support interactive MFA challenges.

The mechanism is straightforward: most organizations enforce MFA through conditional access policies that apply to modern authentication flows (OAuth 2.0, SAML). Legacy protocols authenticate with username and password directly, and the MFA policy never fires. Attackers are not breaking MFA — they are routing around it entirely through protocols that many organizations forgot to disable or assumed were already blocked.

This is not a new vulnerability class. Microsoft has urged legacy auth deprecation for years, and Entra conditional access has supported legacy-auth blocking since 2019. But the 155x surge confirms that the gap persists at scale across enterprise environments. If an organization has even a subset of mailboxes with SMTP or IMAP enabled for backward compatibility — legacy scanners, printers, line-of-business apps — those accounts are exposed.

The fix is binary: block legacy authentication at the conditional access layer with no exceptions, then address the line-of-business dependencies separately using OAuth-capable alternatives or application passwords scoped to specific service accounts with monitoring.

What defenders should do: Audit conditional access policies for legacy auth blocks. Enumerate any service accounts or mailboxes still authenticating via SMTP, POP3, IMAP, or ActiveSync. Enforce deny-by-default for legacy protocols and monitor sign-in logs for clientAppUsed values indicating legacy flows.

Threat Actor Claims 3.6M Azure Entra Records Stolen via Compromised Credentials

A threat actor operating under the handle “TheHatman” is advertising Fortune 500 employee databases allegedly extracted from Microsoft Entra tenants. The claimed vector is credential-based access — no zero-day, no exploit chain, just valid credentials used to authenticate to cloud directories and export user objects at scale.

The claim is unverified. Neither Microsoft nor any independent research firm has confirmed the scope or authenticity of the data. However, the vector aligns precisely with the legacy auth spray activity Huntress is tracking: compromised credentials, used against cloud identity providers, with insufficient controls to detect or prevent bulk data export. Palo Alto’s Unit 42 published updated guidance on mitigating exactly this pattern in response.

Whether TheHatman’s specific claim holds up, the defensive conversation is the same: service principal credential rotation, conditional access policies enforcing device compliance and location restrictions, and continuous monitoring for anomalous directory enumeration behavior. Bulk user object export from an Entra tenant by a single principal should trigger an alert — and in most environments, it does not.

What defenders should do: Audit service principals for static credentials that have never been rotated. Enable Entra sign-in risk policies. Monitor for bulk Graph API calls to /users or /groups endpoints, especially from unfamiliar IPs or service principals.

CISA Adds macOS Authentication Bypass CVE-2026-65400 to KEV

CISA added CVE-2026-65400 (CVSS 9.8) to the Known Exploited Vulnerabilities catalog after confirming active exploitation. The flaw is an improper authentication vulnerability in macOS that allows attackers to bypass OS-level authentication — meaning every identity control built on the assumption that the endpoint is trustworthy is undermined.

For organizations with BYOD or hybrid environments where macOS endpoints access corporate resources, an unpatched device represents a fundamental identity trust violation. Phishing-resistant MFA, conditional access, and ZTNA all assume the device presenting credentials is not already compromised at the authentication layer. CVE-2026-65400 breaks that assumption.

What defenders should do: Patch macOS endpoints immediately. Enforce endpoint posture checks that verify OS patch level before granting access to corporate resources. Quarantine devices that cannot verify current patch status.

TWINLOOT Implant Runs Full C2 Inside SharePoint and Teams via OAuth App Abuse

A Python-based implant called TWINLOOT operates its entire command-and-control infrastructure inside Microsoft 365. It uses SharePoint document libraries for payload staging and exfiltration, and Teams messages for operator tasking. Authentication is handled through overprivileged OAuth applications — the implant never needs to phone home to an external C2 server because the SaaS platform is the C2 server.

This is the non-human identity problem in action. The OAuth apps TWINLOOT abuses are legitimate application registrations with excessive permissions — Sites.ReadWrite.All, Files.ReadWrite.All, Chat.ReadWrite — that were granted during onboarding and never reviewed. The implant’s traffic blends with normal M365 API calls, making network-layer detection nearly impossible without behavioral analysis of OAuth token usage patterns.

What defenders should do: Audit OAuth app registrations in Entra for overprivileged Graph API permissions. Revoke Sites.ReadWrite.All and Files.ReadWrite.All from any app that does not have documented business justification. Monitor for OAuth apps authenticating at unusual hours or accessing SharePoint sites outside their normal scope.

Defender Action Items

  • Block legacy authentication protocols in Entra conditional access policies — SMTP, POP3, IMAP, ActiveSync — with zero exceptions. Address line-of-business dependencies through OAuth-capable alternatives or tightly scoped service accounts with monitoring.
  • Patch macOS endpoints for CVE-2026-65400 immediately. Enforce posture checks at the access layer (ISE, Duo Device Health, or equivalent) that quarantine devices below the patched OS version.
  • Audit Entra OAuth app registrations for Graph API permissions exceeding business need. Revoke Sites.ReadWrite.All, Files.ReadWrite.All, and Chat.ReadWrite from apps without documented justification.
  • Monitor for bulk directory enumeration — alert on single principals making high-volume Graph API calls to /users or /groups endpoints, especially from new IPs or with app-only authentication.
  • Upgrade GitLab CE/EE to address CVE-2026-19478 (CVSS 9.4) — an unauthenticated GraphQL flaw that allows project deletion. Audit public project exposure and GraphQL API access controls.

Detection Spotlight

Monitor for legacy authentication attempts that bypass MFA. In Entra sign-in logs (Azure AD), legacy auth is identified by the clientAppUsed field. The following KQL query surfaces accounts authenticating through legacy protocols — any results indicate MFA bypass exposure:

SigninLogs
| where TimeGenerated > ago(7d)
| where ClientAppUsed in ("Exchange ActiveSync", "IMAP4", "MAPI Over HTTP",
    "Offline Address Book", "Other clients", "Outlook Anywhere (RPC over HTTP)",
    "POP3", "Reporting Web Services", "SMTP", "Exchange Web Services")
| where ResultType == 0  // successful sign-ins only
| summarize AttemptCount = count(), DistinctIPs = dcount(IPAddress)
    by UserPrincipalName, ClientAppUsed, AppDisplayName
| where AttemptCount > 10
| sort by AttemptCount desc

Any successful legacy auth sign-in is a finding. High-volume attempts from a single account or multiple IPs indicate active spray targeting. Cross-reference results with your conditional access policy inventory — if a block policy exists but these sign-ins succeed, the policy has a gap or exclusion.

References

Subscribe to The Identity Brief

Get The Identity Brief in your inbox (Mon/Wed/Fri) — Human, machine, and AI identity security — NHI, ITDR, and the IAM market.